The A100/A110 stsafe_verify wrote *pResult before validating any of
its arguments, unlike the A120 variant which rejects NULL inputs.
Move the argument validation (pointers plus hashSz) ahead of the
*pResult write and the buffer allocation, so a NULL argument returns
BAD_FUNC_ARG instead of dereferencing, and the early return happens
before the SMALL_STACK buffers are allocated.
Addresses the PR review note on *pResult before validation.
hashSz is a caller-supplied word32 (the public wc_ecc_verify_hash API
passes its length straight through to the crypto-cb). Converting it to
int before clamping lets values above INT_MAX wrap negative, and the
normalized-copy pointer arithmetic then writes out of bounds of the
field-size digest buffer. Clamp in the word32 domain first; the int
conversion then only happens for values bounded by key_sz.
Both variants (A120, A100/A110) carry the same fix. Both call sites
already reject key_sz <= 0, so no key_sz check is added here.
Addresses the PR review note on the copy_sz cast.
stsafe_verify copied key_sz bytes from the caller's digest buffer and
told the SE the digest was key_sz bytes long. For a digest shorter than
the field size (P-256 with a 28-byte SHA-224 hash, P-384 with SHA-256)
that reads past the end of the buffer and submits a wrong digest, so a
valid signature fails to verify.
The A120 expects a field-size prehash on the wire, so the digest is
normalized host-side before submission: truncate if longer, left-pad if
shorter - the same convention the sign path already applies. The SE
still receives key_sz bytes, so the wire contract is unchanged; only
the buffer contents for short digests are corrected.
Both variants (A120 STSELib, A100/A110 legacy SDK) and both call sites
(crypto-cb, TLS verify-peer callback) now use the real digest length.
Verification:
- Built: host x86_64, --enable-stsafe=a120, STSELib v1.1.7 + Rust
A120 simulator.
- Tested: wolfCrypt STSAFE-A120 sim test (wolfSSL/simulators
wolfcrypt-test): new P-256 + 28-byte-digest verify case fails on the
pre-fix build (valid signature rejected) and passes post-fix; rng,
on-device keygen, sign and 32-byte verify round-trip unchanged.
- A100/A110 variant not runnable here (closed SDK, no silicon); change
mirrors the A120 logic on the existing buffer and keeps Length=key_sz.
Added a bunch of content about how to use ASN templates.
Added a section with a list of things to do when adding a new template.
Added mappiong of ASN.1 notation to template lines.
Added ASN.1 type specific information.
Added a checklist at the end to head off the common issues.
Added references to ASN_TEMPLATE.md.
Added other informatrion.
wc_curve448_make_key and wc_curve448_export_public_ex derived the public
point through the keyless wc_curve448_make_pub, which dispatches to the
first registered device; route them through a devId-carrying helper.
Mirror curve25519: keygen, shared secret, make pub and generic
callbacks, wc_curve448_init_ex/new/delete, new wc_curve448_generic
API with scalar clamp checks, WOLF_CRYPTO_CB_ONLY_CURVE448 mode,
TLS devId plumbing, tests (test.c, api unit tests, swdev),
benchmark devId, CI entries.
* Add wc_ecc_key_new_ex
Rust wrapper: use wc_ecc_key_new_ex for ECC when available.
Fixes F-8300.
* Check devId after wc_ecc_key_new_ex() call in unit test
The config probe now uses the target include path, and ARM assembly builds in
both modes. Documents the ECIES hardware path, drops a dead protocol branch,
declines a zero length message, and builds the ECC request helpers only where
they are called. Benchmark rows no longer claim hardware they cannot reach.
WOLFSSL_SE050 enables WOLFSSL_KEY_TO_DER, but the original ASN implementation only compiled SetASNIntMP and SetBitString when unrelated features such as ECC or key generation were enabled. An ECC-free SE050 build therefore compiled the RSA DER callers without these helpers and failed at link time.
Include WOLFSSL_KEY_TO_DER in both helper guards, while retaining the NO_CERTS constraint for the public-key BIT STRING encoder. This allows SE050 RSA builds to disable HAVE_ECC without unresolved ASN symbols.
